4 ms·

I've had a long standing question about FreeBSD and ports/portsnap: does/how does FreeBSD prevent against bad mirrors or MITM attacks?

by a--b 13y ago

guerrilla 13y ago
http://forums.freebsd.org/archive/index.php/t-27111.html http://forums.freebsd.org/archive/index.php/t-27111.html
gaadd33 13y ago
AFAIK ports checks the checksum of the file when it downloads it against the checksums the ports maintainer submitted. For the ISO mirrors, I don't think there's anything automatic, you have to manually run sha256 on the file and compare checksums. Do Linux distributions have another way?
- adestefan 13y ago
  Most Linux package managers use GPG signed packages.
  - gaadd33 13y ago
    Right but if you are downloading an ISO you still have to manually verify it correct?
    - lifeisstillgood 13y ago
      yes but a one time md5 of an iso is far less strenuous than manually checking the provenance of 200 tarballs to build say X. there is a new package management system similar to apt-get but it's far rarer to see it used than ports I really like ports - as much for the knowledge that I have all the right header files.
      - gaadd33 13y ago
        When do you have to check the provenance of 200 tarballs to install X? If you install from an ISO, you can install the ports from there too and you have checksums which are automatically checked, right? So if you do cd /usr/ports/x11-wm/xfce4; make install it will automatically check all of the checksums right?
        lifeisstillgood 13y ago
        err, maybe. I don't think I have ever installed x from pkgs on cd. I always download thru ports - the 200 tarballs was what ports does for me (downloads and verifies md5) so if I did not use ports and I did build from source I would manually download and verify. I don't think anyone would ever do that admittedly.
  - profquail 13y ago
    In FreeBSD (and the other BSDs), packages and ports are two separate things. Packages are binary distributions; a port is just a set of patches (if necessary) and a special makefile telling the build system where to download the sources for the software you want to build and any special instructions necessary to build/install it. It makes sense to sign packages, but not ports. Ports do contain checksum files though, to make sure the source tarball/zip you download hasn't been changed -- this is what 'gaadd33' was referring to.
    - adestefan 13y ago
      Very few Linux distributions have the equivalent of FreeBSD's ports. I know of the Arch Linux AUR and they also use checksums in their PKGBUILD files.
cperciva 13y ago
The portsnap buildbox checks out the ports tree over an encrypted and authenticated pipe to the central SVN server. It then packages up the ports tree and signs the result before uploading those bits to the portsnap mirrors. The portsnap client has hash of the signing public key (in /etc/portsnap.conf, where it was placed during the install process) and uses that to check the validity of the bits it downloads from a portsnap mirror.

I've had a long standing question about FreeBSD and ports/portsnap: does/how does FreeBSD prevent against bad mirrors or MITM attacks?

by a--b 13y ago

I've had a long standing question about FreeBSD and ports/portsnap: does/how does FreeBSD prevent against bad mirrors or MITM attacks?

guerrilla 13y ago

http://forums.freebsd.org/archive/index.php/t-27111.html http://forums.freebsd.org/archive/index.php/t-27111.html

gaadd33 13y ago

AFAIK ports checks the checksum of the file when it downloads it against the checksums the ports maintainer submitted. For the ISO mirrors, I don't think there's anything automatic, you have to manually run sha256 on the file and compare checksums. Do Linux distributions have another way?

adestefan 13y ago
Most Linux package managers use GPG signed packages.
- gaadd33 13y ago
  Right but if you are downloading an ISO you still have to manually verify it correct?
  - lifeisstillgood 13y ago
    yes but a one time md5 of an iso is far less strenuous than manually checking the provenance of 200 tarballs to build say X. there is a new package management system similar to apt-get but it's far rarer to see it used than ports I really like ports - as much for the knowledge that I have all the right header files.
    - gaadd33 13y ago
      When do you have to check the provenance of 200 tarballs to install X? If you install from an ISO, you can install the ports from there too and you have checksums which are automatically checked, right? So if you do cd /usr/ports/x11-wm/xfce4; make install it will automatically check all of the checksums right?
      - lifeisstillgood 13y ago
        err, maybe. I don't think I have ever installed x from pkgs on cd. I always download thru ports - the 200 tarballs was what ports does for me (downloads and verifies md5) so if I did not use ports and I did build from source I would manually download and verify. I don't think anyone would ever do that admittedly.
- profquail 13y ago
  In FreeBSD (and the other BSDs), packages and ports are two separate things. Packages are binary distributions; a port is just a set of patches (if necessary) and a special makefile telling the build system where to download the sources for the software you want to build and any special instructions necessary to build/install it. It makes sense to sign packages, but not ports. Ports do contain checksum files though, to make sure the source tarball/zip you download hasn't been changed -- this is what 'gaadd33' was referring to.
  - adestefan 13y ago
    Very few Linux distributions have the equivalent of FreeBSD's ports. I know of the Arch Linux AUR and they also use checksums in their PKGBUILD files.

cperciva 13y ago

The portsnap buildbox checks out the ports tree over an encrypted and authenticated pipe to the central SVN server. It then packages up the ports tree and signs the result before uploading those bits to the portsnap mirrors. The portsnap client has hash of the signing public key (in /etc/portsnap.conf, where it was placed during the install process) and uses that to check the validity of the bits it downloads from a portsnap mirror.